32fd5b4a3cd277cf7a0b1b7f2fd4333ecdfa0696acc7928d4cee5334dc923e28

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 22:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0399792d0fd20c3007152e4cb487f818a7e9f724b3d497792784178f33137cfb.pdf
Size

87KB
MD5

cb0f029ffab6a63d6675a1d8e5b4a43b
SHA1

814317739a38f7d47b1d2bcd4d7b96ea215b92ca
SHA256

0399792d0fd20c3007152e4cb487f818a7e9f724b3d497792784178f33137cfb
SHA512

62ed7d4556961d81f3a744d3a8c9e07fdddd8b229c2e4bbc92531f8fde5571390866c0bf73597cbf42706f3a8e8af43d54a1cb73987600d0c399509658039ee7
SSDEEP

1536:hS3wYcM4xK0ZfvGpiDR2/X3cBJEicawxDUwKvrYC12hijP4OqMQPLyUOaip+ZFLw:c3AM4x3ZXGiscfxJwpUwK04vqMkLIe0P

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1952	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1952	AcroRd32.exe
1952	AcroRd32.exe
1952	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0399792d0fd20c3007152e4cb487f818a7e9f724b3d497792784178f33137cfb.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
65e9a801e462a3262d7e837a4f60651c

SHA1
a0c085ed15d434f174dc984f126f43d3c6258abb

SHA256
0d3d982c2990ad5123d1d5e1172f21988e1f99a046a498fbb4b298b6aa9c7e1b

SHA512
21180ea13e025b4399ff3246ce5d0d80c5b9b6dcc5334cb7584e53020576cd2d5a6fb3e16fab0c2fef9ef26a682009fef9ca4193bf5efbbe7885a6de24cd7939

Download Submit